Commit c0054cb56f1439c7bfda7771f919bdb7f948bab7 | the-knife

apps/server/src/attachmentStore.ts created+95

...	@@ -0,0 +1,95 @@
1	import { randomUUID } from "node:crypto";
2
3	import type { ChatAttachment } from "@t3tools/contracts";
4
5	import {
6	ATTACHMENTS_ROUTE_PREFIX,
7	normalizeAttachmentRelativePath,
8	resolveAttachmentRelativePath,
9	} from "./attachmentPaths.ts";
10	import { inferImageExtension, SAFE_IMAGE_FILE_EXTENSIONS } from "./imageMime.ts";
11
12	const ATTACHMENT_FILENAME_EXTENSIONS = [...SAFE_IMAGE_FILE_EXTENSIONS, ".bin"];
13
14	function toSafeThreadAttachmentSegment(threadId: string): string \| null {
15	const segment = encodeURIComponent(threadId);
16	if (
17	segment.length === 0 \|\|
18	segment === "." \|\|
19	segment === ".." \|\|
20	segment.includes("/") \|\|
21	segment.includes("\\") \|\|
22	segment.includes("\0")
23	) {
24	return null;
25	}
26	return segment;
27	}
28
29	export function createAttachmentId(threadId: string): string \| null {
30	const threadSegment = toSafeThreadAttachmentSegment(threadId);
31	if (!threadSegment) {
32	return null;
33	}
34	return `${threadSegment}-${randomUUID()}`;
35	}
36
37	export function attachmentRelativePath(attachment: ChatAttachment): string {
38	switch (attachment.type) {
39	case "image": {
40	const extension = inferImageExtension({
41	mimeType: attachment.mimeType,
42	fileName: attachment.name,
43	});
44	return `${attachment.id}${extension}`;
45	}
46	}
47	}
48
49	export function resolveAttachmentPath(input: {
50	readonly stateDir: string;
51	readonly attachment: ChatAttachment;
52	}): string \| null {
53	return resolveAttachmentRelativePath({
54	stateDir: input.stateDir,
55	relativePath: attachmentRelativePath(input.attachment),
56	});
57	}
58
59	export function attachmentRoutePath(attachment: ChatAttachment): string {
60	return `${ATTACHMENTS_ROUTE_PREFIX}/${encodeURIComponent(attachment.id)}`;
61	}
62
63	export function resolveAttachmentPathById(input: {
64	readonly stateDir: string;
65	readonly attachmentId: string;
66	}): string \| null {
67	const normalizedId = normalizeAttachmentRelativePath(input.attachmentId);
68	if (!normalizedId \|\| normalizedId.includes("/") \|\| normalizedId.includes(".")) {
69	return null;
70	}
71	for (const extension of ATTACHMENT_FILENAME_EXTENSIONS) {
72	const maybePath = resolveAttachmentRelativePath({
73	stateDir: input.stateDir,
74	relativePath: `${normalizedId}${extension}`,
75	});
76	if (maybePath) {
77	return maybePath;
78	}
79	}
80	return null;
81	}
82
83	export function parseAttachmentIdFromRelativePath(relativePath: string): string \| null {
84	const normalized = normalizeAttachmentRelativePath(relativePath);
85	if (!normalized \|\| normalized.includes("/")) {
86	return null;
87	}
88	const extensionIndex = normalized.lastIndexOf(".");
89	if (extensionIndex <= 0) {
90	return null;
91	}
92	const id = normalized.slice(0, extensionIndex);
93	return id.length > 0 && !id.includes(".") ? id : null;
94	}
95

apps/server/src/codexAppServerManager.test.ts+2-8

 @@ -191,10 +191,7 @@ describe("sendTurn", () => {
       attachments: [
         {
           type: "image",
-          name: "error.png",
+          url: "data:image/png;base64,AAAA",
-          mimeType: "image/png",
-          sizeBytes: 1_024,
-          dataUrl: "data:image/png;base64,AAAA",
         },
       ],
       model: "gpt-5.3",
 @@ -242,10 +239,7 @@ describe("sendTurn", () => {
       attachments: [
         {
           type: "image",
-          name: "diagram.png",
+          url: "data:image/png;base64,BBBB",
-          mimeType: "image/png",
-          sizeBytes: 256,
-          dataUrl: "data:image/png;base64,BBBB",
         },
       ],
     });

apps/server/src/codexAppServerManager.ts+10-3

...	@@ -14,7 +14,6 @@ import {	...	@@ -14,7 +14,6 @@ import {
14	normalizeModelSlug,	14	normalizeModelSlug,
15	type ProviderApprovalDecision,	15	type ProviderApprovalDecision,
16	type ProviderEvent,	16	type ProviderEvent,
17	type ProviderSendTurnInput,
18	type ProviderSession,	17	type ProviderSession,
19	type ProviderSessionStartInput,	18	type ProviderSessionStartInput,
20	type ProviderTurnStartResult,	19	type ProviderTurnStartResult,
...	@@ -71,6 +70,14 @@ interface JsonRpcNotification {	...	@@ -71,6 +70,14 @@ interface JsonRpcNotification {
71	params?: unknown;	70	params?: unknown;
72	}	71	}
73		72
		73	export interface CodexAppServerSendTurnInput {
		74	readonly sessionId: ProviderSessionId;
		75	readonly input?: string;
		76	readonly attachments?: ReadonlyArray<{ type: "image"; url: string }>;
		77	readonly model?: string;
		78	readonly effort?: string;
		79	}
		80
74	export interface CodexThreadTurnSnapshot {	81	export interface CodexThreadTurnSnapshot {
75	id: ProviderTurnId;	82	id: ProviderTurnId;
76	items: unknown[];	83	items: unknown[];
...	@@ -290,7 +297,7 @@ export class CodexAppServerManager extends EventEmitter<CodexAppServerManagerEve	...	@@ -290,7 +297,7 @@ export class CodexAppServerManager extends EventEmitter<CodexAppServerManagerEve
290	}	297	}
291	}	298	}
292		299
293	async sendTurn(input: ProviderSendTurnInput): Promise<ProviderTurnStartResult> {	300	async sendTurn(input: CodexAppServerSendTurnInput): Promise<ProviderTurnStartResult> {
294	const context = this.requireSession(input.sessionId);	301	const context = this.requireSession(input.sessionId);
295	if (!context.session.threadId) {	302	if (!context.session.threadId) {
296	throw new Error("Session is missing a thread id.");	303	throw new Error("Session is missing a thread id.");
...	@@ -310,7 +317,7 @@ export class CodexAppServerManager extends EventEmitter<CodexAppServerManagerEve	...	@@ -310,7 +317,7 @@ export class CodexAppServerManager extends EventEmitter<CodexAppServerManagerEve
310	if (attachment.type === "image") {	317	if (attachment.type === "image") {
311	turnInput.push({	318	turnInput.push({
312	type: "image",	319	type: "image",
313	url: attachment.dataUrl,	320	url: attachment.url,
314	});	321	});
315	}	322	}
316	}	323	}

apps/server/src/git/Layers/CodexTextGeneration.test.ts+33-31

 @@ -294,28 +294,36 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
         stdinMustContain: "Attachment metadata:",
       },
       Effect.gen(function* () {
-        const textGeneration = yield* TextGeneration;
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const attachmentId = `thread-branch-image-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+        const attachmentPath = path.join(process.cwd(), "attachments", `${attachmentId}.png`);
+        yield* fs.makeDirectory(path.join(process.cwd(), "attachments"), { recursive: true });
+        yield* fs.writeFile(attachmentPath, Buffer.from("hello"));
-        const generated = yield* textGeneration.generateBranchName({
+        const textGeneration = yield* TextGeneration;
-          cwd: process.cwd(),
+        const generated = yield* textGeneration
-          message: "Fix layout bug from screenshot.",
+          .generateBranchName({
-          attachments: [
+            cwd: process.cwd(),
-            {
+            message: "Fix layout bug from screenshot.",
-              type: "image",
+            attachments: [
-              name: "bug.png",
+              {
-              mimeType: "image/png",
+                type: "image",
-              sizeBytes: 5,
+                id: attachmentId,
-              dataUrl: "data:image/png;base64,SGVsbG8=",
+                name: "bug.png",
-            },
+                mimeType: "image/png",
-          ],
+                sizeBytes: 5,
-        });
+              },
+            ],
+          })
+          .pipe(Effect.ensuring(fs.remove(attachmentPath).pipe(Effect.catch(() => Effect.void))));
         expect(generated.branch).toBe("fix/ui-regression");
       }),
     ),
   );
-  it.effect("resolves persisted attachment URLs to files for codex image inputs", () =>
+  it.effect("resolves persisted attachment ids to files for codex image inputs", () =>
     withFakeCodexEnv(
       {
         output: JSON.stringify({
 @@ -326,12 +334,10 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const uniqueSuffix = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+        const attachmentId =
-        const imageFileName = `message-1-${uniqueSuffix}.png`;
+          `thread-1-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
-        const imagePath = path.join(process.cwd(), "attachments", "thread-1", imageFileName);
+        const imagePath = path.join(process.cwd(), "attachments", `${attachmentId}.png`);
-        yield* fs.makeDirectory(path.join(process.cwd(), "attachments", "thread-1"), {
+        yield* fs.makeDirectory(path.join(process.cwd(), "attachments"), { recursive: true });
-          recursive: true,
-        });
         yield* fs.writeFile(imagePath, Buffer.from("hello"));
         const textGeneration = yield* TextGeneration;
 @@ -342,10 +348,10 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
             attachments: [
               {
                 type: "image",
+                id: attachmentId,
                 name: "bug.png",
                 mimeType: "image/png",
                 sizeBytes: 5,
-                dataUrl: `/attachments/thread-1/${imageFileName}`,
               },
             ],
           })
 @@ -357,8 +363,6 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
                 }),
               ),
             ),
-          )
-          .pipe(
             Effect.ensuring(
               fs.remove(imagePath).pipe(Effect.catch(() => Effect.void)),
             ),
 @@ -369,7 +373,7 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
     ),
   );
-  it.effect("ignores absolute non-route attachment paths for codex image inputs", () =>
+  it.effect("ignores missing attachment ids for codex image inputs", () =>
     withFakeCodexEnv(
       {
         output: JSON.stringify({
 @@ -380,11 +384,9 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const tempDir = yield* fs.makeTempDirectoryScoped({
+        const missingAttachmentId = `thread-missing-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
-          prefix: "t3code-codex-attachment-bypass-",
+        const missingPath = path.join(process.cwd(), "attachments", `${missingAttachmentId}.png`);
-        });
+        yield* fs.remove(missingPath).pipe(Effect.catch(() => Effect.void));
-        const absoluteImagePath = path.join(tempDir, "outside.png");
-        yield* fs.writeFile(absoluteImagePath, Buffer.from("hello"));
         const textGeneration = yield* TextGeneration;
         const result = yield* textGeneration
 @@ -394,10 +396,10 @@ it.layer(CodexTextGenerationTestLayer)("CodexTextGenerationLive", (it) => {
             attachments: [
               {
                 type: "image",
+                id: missingAttachmentId,
                 name: "outside.png",
                 mimeType: "image/png",
                 sizeBytes: 5,
-                dataUrl: absoluteImagePath,
               },
             ],
           })

apps/server/src/git/Layers/CodexTextGeneration.ts+14-75

 @@ -3,10 +3,9 @@ import { randomUUID } from "node:crypto";
 import { Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { resolveAttachmentRoutePath } from "../../attachmentPaths.ts";
+import { resolveAttachmentPath } from "../../attachmentStore.ts";
 import { ServerConfig } from "../../config.ts";
 import { TextGenerationError } from "../Errors.ts";
-import { inferImageExtension, parseBase64DataUrl } from "../../imageMime.ts";
 import {
   type BranchNameGenerationInput,
   type BranchNameGenerationResult,
 @@ -109,7 +108,6 @@ const makeCodexTextGeneration = Effect.gen(function* () {
   type MaterializedImageAttachments = {
     readonly imagePaths: ReadonlyArray<string>;
-    readonly tempImagePaths: ReadonlyArray<string>;
   };
   const readStreamAsString = <E>(
 @@ -151,96 +149,41 @@ const makeCodexTextGeneration = Effect.gen(function* () {
     );
   };
-  const writeTempBinaryFile = (
-    operation: string,
-    prefix: string,
-    bytes: Uint8Array,
-    extension: string,
-  ): Effect.Effect<string, TextGenerationError> => {
-    const normalizedExtension = extension.startsWith(".") ? extension : `.${extension}`;
-    const filePath = path.join(
-      tempDir,
-      `t3code-${prefix}-${process.pid}-${randomUUID()}${normalizedExtension}`,
-    );
-    return fileSystem.writeFile(filePath, bytes).pipe(
-      Effect.mapError(
-        (cause) =>
-          new TextGenerationError({
-            operation,
-            detail: `Failed to write temp file at ${filePath}.`,
-            cause,
-          }),
-      ),
-      Effect.as(filePath),
-    );
-  };
   const safeUnlink = (filePath: string): Effect.Effect<void, never> =>
     fileSystem.remove(filePath).pipe(Effect.catch(() => Effect.void));
   const materializeImageAttachments = (
-    operation: "generateCommitMessage" | "generatePrContent" | "generateBranchName",
+    _operation: "generateCommitMessage" | "generatePrContent" | "generateBranchName",
     attachments: BranchNameGenerationInput["attachments"],
-  ): Effect.Effect<MaterializedImageAttachments, TextGenerationError> => {
+  ): Effect.Effect<MaterializedImageAttachments, TextGenerationError> =>
-    const tempImagePaths: string[] = [];
+    Effect.gen(function* () {
-    return Effect.gen(function* () {
       if (!attachments || attachments.length === 0) {
-        return { imagePaths: [], tempImagePaths };
+        return { imagePaths: [] };
       }
       const imagePaths: string[] = [];
-      for (const [index, attachment] of attachments.entries()) {
+      for (const attachment of attachments) {
         if (attachment.type !== "image") {
           continue;
         }
-        const parsed = parseBase64DataUrl(attachment.dataUrl);
+        const resolvedPath = resolveAttachmentPath({
-        if (parsed && parsed.mimeType.startsWith("image/")) {
-          const bytes = Buffer.from(parsed.base64, "base64");
-          if (bytes.byteLength === 0) {
-            continue;
-          }
-          const extension = inferImageExtension({
-            mimeType: parsed.mimeType,
-            fileName: attachment.name,
-          });
-          const imagePath = yield* writeTempBinaryFile(
-            operation,
-            `codex-image-${index}`,
-            bytes,
-            extension,
-          );
-          imagePaths.push(imagePath);
-          tempImagePaths.push(imagePath);
-          continue;
-        }
-        const persistedPath = resolveAttachmentRoutePath({
           stateDir: serverConfig.stateDir,
-          dataUrl: attachment.dataUrl,
+          attachment,
         });
-        if (!persistedPath || !path.isAbsolute(persistedPath)) {
+        if (!resolvedPath || !path.isAbsolute(resolvedPath)) {
           continue;
         }
         const fileInfo = yield* fileSystem
-          .stat(persistedPath)
+          .stat(resolvedPath)
           .pipe(Effect.catch(() => Effect.succeed(null)));
         if (!fileInfo || fileInfo.type !== "File") {
           continue;
         }
-        imagePaths.push(persistedPath);
+        imagePaths.push(resolvedPath);
       }
-      return { imagePaths, tempImagePaths };
+      return { imagePaths };
-    }).pipe(
+    });
-      Effect.tapError(() =>
-        Effect.all(tempImagePaths.map((filePath) => safeUnlink(filePath)), {
-          concurrency: "unbounded",
-        }).pipe(Effect.asVoid),
-      ),
-    );
-  };
   const runCodexJson = <S extends Schema.Top>({
     operation,
 @@ -454,10 +397,7 @@ const makeCodexTextGeneration = Effect.gen(function* () {
   const generateBranchName: TextGenerationShape["generateBranchName"] = (input) => {
     return Effect.gen(function* () {
-      const { imagePaths, tempImagePaths } = yield* materializeImageAttachments(
+      const { imagePaths } = yield* materializeImageAttachments("generateBranchName", input.attachments);
-        "generateBranchName",
-        input.attachments,
-      );
       const attachmentLines = (input.attachments ?? []).map(
         (attachment) =>
           `- ${attachment.name} (${attachment.mimeType}, ${attachment.sizeBytes} bytes)`,
 @@ -492,7 +432,6 @@ const makeCodexTextGeneration = Effect.gen(function* () {
           branch: Schema.String,
         }),
         imagePaths,
-        cleanupPaths: tempImagePaths,
       });
       return {

apps/server/src/main.test.ts+14-3

...	@@ -49,10 +49,21 @@ const testLayer = Layer.mergeAll(	...	@@ -49,10 +49,21 @@ const testLayer = Layer.mergeAll(
49	const runCli = (	49	const runCli = (
50	args: ReadonlyArray<string>,	50	args: ReadonlyArray<string>,
51	env: Record<string, string> = { T3CODE_NO_BROWSER: "true" },	51	env: Record<string, string> = { T3CODE_NO_BROWSER: "true" },
52	) =>	52	) => {
53	Command.runWith(t3Cli, { version: "0.0.0-test" })(args).pipe(	53	const uniqueStateDir = `/tmp/t3-cli-state-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
54	Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env }))),	54	return Command.runWith(t3Cli, { version: "0.0.0-test" })(args).pipe(
		55	Effect.provide(
		56	ConfigProvider.layer(
		57	ConfigProvider.fromEnv({
		58	env: {
		59	T3CODE_STATE_DIR: uniqueStateDir,
		60	...env,
		61	},
		62	}),
		63	),
		64	),
55	);	65	);
		66	};
56		67
57	beforeEach(() => {	68	beforeEach(() => {
58	vi.clearAllMocks();	69	vi.clearAllMocks();

apps/server/src/orchestration/Layers/ProjectionPipeline.test.ts+51-65

 @@ -178,7 +178,7 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
     }),
   );
-  it.effect("materializes message image attachments into stateDir and stores URL references", () =>
+  it.effect("stores message attachment references without mutating payloads", () =>
     Effect.sync(() => fs.mkdtempSync(path.join(os.tmpdir(), "t3-projection-attachments-"))).pipe(
       Effect.flatMap((stateDir) =>
         Effect.gen(function* () {
 @@ -205,10 +205,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
               attachments: [
                 {
                   type: "image",
+                  id: "thread-attachments-att-1",
                   name: "example.png",
                   mimeType: "image/png",
                   sizeBytes: 5,
-                  dataUrl: "data:image/png;base64,SGVsbG8=",
                 },
               ],
               turnId: null,
 @@ -232,21 +232,12 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           assert.deepEqual(JSON.parse(rows[0]?.attachmentsJson ?? "null"), [
             {
               type: "image",
+              id: "thread-attachments-att-1",
               name: "example.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "/attachments/thread-attachments/message-attachments-0.png",
             },
           ]);
-          const attachmentPath = path.join(
-            stateDir,
-            "attachments",
-            "thread-attachments",
-            "message-attachments-0.png",
-          );
-          assert.equal(fs.existsSync(attachmentPath), true);
-          assert.deepEqual(fs.readFileSync(attachmentPath), Buffer.from("SGVsbG8=", "base64"));
         }).pipe(
           (effect) => runWithProjectionPipelineLayer(stateDir, effect),
           Effect.ensuring(Effect.sync(() => fs.rmSync(stateDir, { recursive: true, force: true }))),
 @@ -255,7 +246,7 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
     ),
   );
-  it.effect("materializes only image data URLs and uses a safe extension whitelist", () =>
+  it.effect("preserves mixed image attachment metadata as-is", () =>
     Effect.sync(() => fs.mkdtempSync(path.join(os.tmpdir(), "t3-projection-attachments-"))).pipe(
       Effect.flatMap((stateDir) =>
         Effect.gen(function* () {
 @@ -282,17 +273,17 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
               attachments: [
                 {
                   type: "image",
+                  id: "thread-attachments-safe-att-1",
                   name: "untrusted.exe",
                   mimeType: "image/x-unknown",
                   sizeBytes: 5,
-                  dataUrl: "data:image/x-unknown;base64,SGVsbG8=",
                 },
                 {
                   type: "image",
+                  id: "thread-attachments-safe-att-2",
                   name: "not-image.png",
                   mimeType: "image/png",
                   sizeBytes: 5,
-                  dataUrl: "data:text/plain;base64,SGVsbG8=",
                 },
               ],
               turnId: null,
 @@ -316,36 +307,19 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           assert.deepEqual(JSON.parse(rows[0]?.attachmentsJson ?? "null"), [
             {
               type: "image",
+              id: "thread-attachments-safe-att-1",
               name: "untrusted.exe",
               mimeType: "image/x-unknown",
               sizeBytes: 5,
-              dataUrl: "/attachments/thread-attachments-safe/message-attachments-safe-0.bin",
             },
             {
               type: "image",
+              id: "thread-attachments-safe-att-2",
               name: "not-image.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:text/plain;base64,SGVsbG8=",
             },
           ]);
-          const firstAttachmentPath = path.join(
-            stateDir,
-            "attachments",
-            "thread-attachments-safe",
-            "message-attachments-safe-0.bin",
-          );
-          assert.equal(fs.existsSync(firstAttachmentPath), true);
-          assert.deepEqual(fs.readFileSync(firstAttachmentPath), Buffer.from("SGVsbG8=", "base64"));
-          const secondAttachmentPath = path.join(
-            stateDir,
-            "attachments",
-            "thread-attachments-safe",
-            "message-attachments-safe-1.png",
-          );
-          assert.equal(fs.existsSync(secondAttachmentPath), false);
         }).pipe(
           (effect) => runWithProjectionPipelineLayer(stateDir, effect),
           Effect.ensuring(Effect.sync(() => fs.rmSync(stateDir, { recursive: true, force: true }))),
 @@ -425,10 +399,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
             attachments: [
               {
                 type: "image",
+                id: "thread-clear-attachments-att-1",
                 name: "clear.png",
                 mimeType: "image/png",
                 sizeBytes: 5,
-                dataUrl: "data:image/png;base64,SGVsbG8=",
               },
             ],
             turnId: null,
 @@ -477,17 +451,18 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
   );
   it.effect(
-    "overwrites attachment file bytes when a message updates the same attachment index",
+    "overwrites stored attachment references when a message updates attachments",
     () =>
       Effect.sync(() =>
         fs.mkdtempSync(path.join(os.tmpdir(), "t3-projection-attachments-overwrite-")),
       ).pipe(
-        Effect.flatMap((stateDir) =>
+          Effect.flatMap((stateDir) =>
-          Effect.gen(function* () {
+            Effect.gen(function* () {
-            const projectionPipeline = yield* OrchestrationProjectionPipeline;
+              const projectionPipeline = yield* OrchestrationProjectionPipeline;
-            const eventStore = yield* OrchestrationEventStore;
+              const eventStore = yield* OrchestrationEventStore;
-            const now = new Date().toISOString();
+              const sql = yield* SqlClient.SqlClient;
-            const later = new Date(Date.now() + 1_000).toISOString();
+              const now = new Date().toISOString();
+              const later = new Date(Date.now() + 1_000).toISOString();
             yield* eventStore.append({
           type: "project.created",
 @@ -550,10 +525,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
             attachments: [
               {
                 type: "image",
+                id: "thread-overwrite-att-1",
                 name: "file.png",
                 mimeType: "image/png",
                 sizeBytes: 5,
-                dataUrl: "data:image/png;base64,SGVsbG8=",
               },
             ],
             turnId: null,
 @@ -581,10 +556,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
             attachments: [
               {
                 type: "image",
+                id: "thread-overwrite-att-2",
                 name: "file.png",
                 mimeType: "image/png",
                 sizeBytes: 5,
-                dataUrl: "data:image/png;base64,V29ybGQ=",
               },
             ],
             turnId: null,
 @@ -596,14 +571,23 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
             yield* projectionPipeline.bootstrap;
-            const attachmentPath = path.join(
+            const rows = yield* sql<{
-              stateDir,
+              readonly attachmentsJson: string | null;
-              "attachments",
+            }>`
-              "thread-overwrite",
+              SELECT attachments_json AS "attachmentsJson"
-              "message-overwrite-0.png",
+              FROM projection_thread_messages
-            );
+              WHERE message_id = 'message-overwrite'
-            assert.equal(fs.existsSync(attachmentPath), true);
+            `;
-            assert.deepEqual(fs.readFileSync(attachmentPath), Buffer.from("V29ybGQ=", "base64"));
+            assert.equal(rows.length, 1);
+            assert.deepEqual(JSON.parse(rows[0]?.attachmentsJson ?? "null"), [
+              {
+                type: "image",
+                id: "thread-overwrite-att-2",
+                name: "file.png",
+                mimeType: "image/png",
+                sizeBytes: 5,
+              },
+            ]);
           }).pipe(
             (effect) => runWithProjectionPipelineLayer(stateDir, effect),
             Effect.ensuring(
 @@ -701,10 +685,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
                 attachments: [
                   {
                     type: "image",
+                    id: "thread-rollback-att-1",
                     name: "rollback.png",
                     mimeType: "image/png",
                     sizeBytes: 5,
-                    dataUrl: "data:image/png;base64,SGVsbG8=",
                   },
                 ],
                 turnId: null,
 @@ -728,8 +712,7 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           const attachmentPath = path.join(
             stateDir,
             "attachments",
-            "thread-rollback",
+            "thread-rollback-att-1.png",
-            "message-rollback-0.png",
           );
           assert.equal(fs.existsSync(attachmentPath), false);
           yield* sql`DROP TRIGGER IF EXISTS fail_thread_messages_projection_state_update`;
 @@ -839,10 +822,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           attachments: [
             {
               type: "image",
+              id: "thread-revert-files-keep",
               name: "keep.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:image/png;base64,SGVsbG8=",
             },
           ],
           turnId: TurnId.makeUnsafe("turn-keep"),
 @@ -892,10 +875,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           attachments: [
             {
               type: "image",
+              id: "thread-revert-files-remove",
               name: "remove.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:image/png;base64,V29ybGQ=",
             },
           ],
           turnId: TurnId.makeUnsafe("turn-remove"),
 @@ -908,15 +891,16 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
       const keepPath = path.join(
         stateDir,
         "attachments",
-        "thread-revert-files",
+        "thread-revert-files-keep.png",
-        "message-keep-0.png",
       );
       const removePath = path.join(
         stateDir,
         "attachments",
-        "thread-revert-files",
+        "thread-revert-files-remove.png",
-        "message-remove-0.png",
       );
+      fs.mkdirSync(path.join(stateDir, "attachments"), { recursive: true });
+      fs.writeFileSync(keepPath, Buffer.from("keep"));
+      fs.writeFileSync(removePath, Buffer.from("remove"));
       assert.equal(fs.existsSync(keepPath), true);
       assert.equal(fs.existsSync(removePath), true);
 @@ -1022,10 +1006,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
           attachments: [
             {
               type: "image",
+              id: "thread-delete-files-att-1",
               name: "delete.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:image/png;base64,SGVsbG8=",
             },
           ],
           turnId: null,
 @@ -1035,8 +1019,10 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
         },
       });
-      const threadAttachmentDir = path.join(stateDir, "attachments", "thread-delete-files");
+      const threadAttachmentPath = path.join(stateDir, "attachments", "thread-delete-files-att-1.png");
-      assert.equal(fs.existsSync(threadAttachmentDir), true);
+      fs.mkdirSync(path.join(stateDir, "attachments"), { recursive: true });
+      fs.writeFileSync(threadAttachmentPath, Buffer.from("delete"));
+      assert.equal(fs.existsSync(threadAttachmentPath), true);
       yield* appendAndProject({
         type: "thread.deleted",
 @@ -1054,7 +1040,7 @@ projectionLayer("OrchestrationProjectionPipeline", (it) => {
         },
       });
-          assert.equal(fs.existsSync(threadAttachmentDir), false);
+          assert.equal(fs.existsSync(threadAttachmentPath), false);
         }).pipe(
           (effect) => runWithProjectionPipelineLayer(stateDir, effect),
           Effect.ensuring(Effect.sync(() => fs.rmSync(stateDir, { recursive: true, force: true }))),

apps/server/src/orchestration/Layers/ProjectionPipeline.ts+33-103

...	@@ -37,8 +37,7 @@ import {	...	@@ -37,8 +37,7 @@ import {
37	OrchestrationProjectionPipeline,	37	OrchestrationProjectionPipeline,
38	type OrchestrationProjectionPipelineShape,	38	type OrchestrationProjectionPipelineShape,
39	} from "../Services/ProjectionPipeline.ts";	39	} from "../Services/ProjectionPipeline.ts";
40	import { ATTACHMENTS_ROUTE_PREFIX, attachmentRouteToRelativePath } from "../../attachmentPaths.ts";	40	import { attachmentRelativePath } from "../../attachmentStore.ts";
41	import { inferImageExtension, parseBase64DataUrl } from "../../imageMime.ts";
42		41
43	export const ORCHESTRATION_PROJECTOR_NAMES = {	42	export const ORCHESTRATION_PROJECTOR_NAMES = {
44	projects: "projection.projects",	43	projects: "projection.projects",
...	@@ -62,13 +61,7 @@ interface ProjectorDefinition {	...	@@ -62,13 +61,7 @@ interface ProjectorDefinition {
62	) => Effect.Effect<void, ProjectionRepositoryError>;	61	) => Effect.Effect<void, ProjectionRepositoryError>;
63	}	62	}
64		63
65	interface PendingAttachmentWrite {
66	readonly absolutePath: string;
67	readonly bytes: Uint8Array;
68	}
69
70	interface AttachmentSideEffects {	64	interface AttachmentSideEffects {
71	readonly writes: Array<PendingAttachmentWrite>;
72	readonly deletedThreadIds: Set<string>;	65	readonly deletedThreadIds: Set<string>;
73	readonly prunedThreadRelativePaths: Map<string, Set<string>>;	66	readonly prunedThreadRelativePaths: Map<string, Set<string>>;
74	}	67	}
...	@@ -89,62 +82,10 @@ function toSafeThreadAttachmentSegment(threadId: string): string \| null {	...	@@ -89,62 +82,10 @@ function toSafeThreadAttachmentSegment(threadId: string): string \| null {
89	}	82	}
90		83
91	const materializeAttachmentsForProjection = Effect.fn(function* (input: {	84	const materializeAttachmentsForProjection = Effect.fn(function* (input: {
92	readonly threadId: string;
93	readonly messageId: string;
94	readonly attachments: ReadonlyArray<ChatAttachment>;	85	readonly attachments: ReadonlyArray<ChatAttachment>;
95	readonly stageFileWrite: (pendingWrite: PendingAttachmentWrite) => void;
96	}) {	86	}) {
97	if (input.attachments.length === 0) return [];	87	if (input.attachments.length === 0) return [];
98		88	return input.attachments;
99	const serverConfig = yield* Effect.service(ServerConfig);
100
101	const path = yield* Path.Path;
102	const attachmentsRootDir = path.join(serverConfig.stateDir, "attachments");
103	const threadSegment = toSafeThreadAttachmentSegment(input.threadId);
104	if (!threadSegment) {
105	yield* Effect.logWarning("skipping attachment materialization for unsafe thread id", {
106	threadId: input.threadId,
107	messageId: input.messageId,
108	});
109	return input.attachments;
110	}
111	const messageSegment = encodeURIComponent(input.messageId);
112
113	return yield* Effect.forEach(
114	input.attachments,
115	(attachment, index) =>
116	Effect.sync(() => {
117	if (attachment.type !== "image" \|\| !attachment.dataUrl.startsWith("data:")) {
118	return attachment;
119	}
120
121	const parsed = parseBase64DataUrl(attachment.dataUrl);
122	if (!parsed) {
123	return attachment;
124	}
125	if (!parsed.mimeType.startsWith("image/")) {
126	return attachment;
127	}
128
129	const bytes = Buffer.from(parsed.base64, "base64");
130	if (bytes.byteLength === 0) return attachment;
131
132	const fileName = `${index}${inferImageExtension({
133	mimeType: parsed.mimeType,
134	fileName: attachment.name,
135	})}`;
136	const uniqueFileName = `${messageSegment}-${fileName}`;
137	const relativePath = `${threadSegment}/${uniqueFileName}`;
138	const absolutePath = path.join(attachmentsRootDir, threadSegment, uniqueFileName);
139	input.stageFileWrite({ absolutePath, bytes });
140
141	return {
142	...attachment,
143	dataUrl: `${ATTACHMENTS_ROUTE_PREFIX}/${relativePath}`,
144	} satisfies ChatAttachment;
145	}),
146	{ concurrency: 1 },
147	);
148	});	89	});
149		90
150	function extractActivityRequestId(payload: unknown): ApprovalRequestId \| null {	91	function extractActivityRequestId(payload: unknown): ApprovalRequestId \| null {
...	@@ -267,22 +208,16 @@ function collectThreadAttachmentRelativePaths(	...	@@ -267,22 +208,16 @@ function collectThreadAttachmentRelativePaths(
267	if (!threadSegment) {	208	if (!threadSegment) {
268	return new Set();	209	return new Set();
269	}	210	}
270	const threadPrefix = `${threadSegment}/`;
271	const relativePaths = new Set<string>();	211	const relativePaths = new Set<string>();
272	for (const message of messages) {	212	for (const message of messages) {
273	for (const attachment of message.attachments ?? []) {	213	for (const attachment of message.attachments ?? []) {
274	if (attachment.type !== "image") {	214	if (attachment.type !== "image") {
275	continue;	215	continue;
276	}	216	}
277	const relativePath = attachmentRouteToRelativePath(attachment.dataUrl);	217	if (!attachment.id.startsWith(`${threadSegment}-`)) {
278	if (!relativePath \|\| !relativePath.startsWith(threadPrefix)) {
279	continue;	218	continue;
280	}	219	}
281	const threadRelativePath = relativePath.slice(threadPrefix.length).replace(/^[/\\]+/, "");	220	relativePaths.add(attachmentRelativePath(attachment));
282	if (threadRelativePath.length === 0 \|\| threadRelativePath.startsWith("..")) {
283	continue;
284	}
285	relativePaths.add(threadRelativePath.replace(/\\/g, "/"));
286	}	221	}
287	}	222	}
288	return relativePaths;	223	return relativePaths;
...	@@ -306,8 +241,26 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid	...	@@ -306,8 +241,26 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid
306	});	241	});
307	return;	242	return;
308	}	243	}
309	const threadDir = path.join(attachmentsRootDir, threadSegment);	244	const entries = yield* fileSystem
310	yield* fileSystem.remove(threadDir, { recursive: true, force: true });	245	.readDirectory(attachmentsRootDir, { recursive: false })
		246	.pipe(Effect.catch(() => Effect.succeed([] as Array<string>)));
		247	yield* Effect.forEach(
		248	entries,
		249	(entry) =>
		250	Effect.gen(function* () {
		251	const normalizedEntry = entry.replace(/^[/\\]+/, "").replace(/\\/g, "/");
		252	if (normalizedEntry.length === 0 \|\| normalizedEntry.includes("/")) {
		253	return;
		254	}
		255	if (!normalizedEntry.startsWith(`${threadSegment}-`)) {
		256	return;
		257	}
		258	yield* fileSystem.remove(path.join(attachmentsRootDir, normalizedEntry), {
		259	force: true,
		260	});
		261	}),
		262	{ concurrency: 1 },
		263	);
311	}),	264	}),
312	{ concurrency: 1 },	265	{ concurrency: 1 },
313	);	266	);
...	@@ -324,20 +277,22 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid	...	@@ -324,20 +277,22 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid
324	yield* Effect.logWarning("skipping attachment prune for unsafe thread id", { threadId });	277	yield* Effect.logWarning("skipping attachment prune for unsafe thread id", { threadId });
325	return;	278	return;
326	}	279	}
327	const threadDir = path.join(attachmentsRootDir, threadSegment);
328	const entries = yield* fileSystem	280	const entries = yield* fileSystem
329	.readDirectory(threadDir, { recursive: true })	281	.readDirectory(attachmentsRootDir, { recursive: false })
330	.pipe(Effect.catch(() => Effect.succeed([] as Array<string>)));	282	.pipe(Effect.catch(() => Effect.succeed([] as Array<string>)));
331	yield* Effect.forEach(	283	yield* Effect.forEach(
332	entries,	284	entries,
333	(entry) =>	285	(entry) =>
334	Effect.gen(function* () {	286	Effect.gen(function* () {
335	const threadRelativePath = entry.replace(/^[/\\]+/, "").replace(/\\/g, "/");	287	const relativePath = entry.replace(/^[/\\]+/, "").replace(/\\/g, "/");
336	if (threadRelativePath.length === 0 \|\| threadRelativePath.startsWith("..")) {	288	if (relativePath.length === 0 \|\| relativePath.includes("/")) {
		289	return;
		290	}
		291	if (!relativePath.startsWith(`${threadSegment}-`)) {
337	return;	292	return;
338	}	293	}
339		294
340	const absolutePath = path.join(threadDir, threadRelativePath);	295	const absolutePath = path.join(attachmentsRootDir, relativePath);
341	const fileInfo = yield* fileSystem	296	const fileInfo = yield* fileSystem
342	.stat(absolutePath)	297	.stat(absolutePath)
343	.pipe(Effect.catch(() => Effect.succeed(null)));	298	.pipe(Effect.catch(() => Effect.succeed(null)));
...	@@ -345,7 +300,7 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid	...	@@ -345,7 +300,7 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid
345	return;	300	return;
346	}	301	}
347		302
348	if (!keptThreadRelativePaths.has(threadRelativePath)) {	303	if (!keptThreadRelativePaths.has(relativePath)) {
349	yield* fileSystem.remove(absolutePath, { force: true });	304	yield* fileSystem.remove(absolutePath, { force: true });
350	}	305	}
351	}),	306	}),
...	@@ -356,22 +311,6 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid	...	@@ -356,22 +311,6 @@ const runAttachmentSideEffects = Effect.fn(function* (sideEffects: AttachmentSid
356	{ concurrency: 1 },	311	{ concurrency: 1 },
357	);	312	);
358		313
359	const writesByPath = new Map<string, Uint8Array>();
360	for (const pendingWrite of sideEffects.writes) {
361	// Last write wins for a path so updated attachment contents replace stale bytes.
362	writesByPath.set(pendingWrite.absolutePath, pendingWrite.bytes);
363	}
364	yield* Effect.forEach(
365	writesByPath.entries(),
366	([absolutePath, bytes]) =>
367	Effect.gen(function* () {
368	yield* fileSystem.makeDirectory(path.dirname(absolutePath), {
369	recursive: true,
370	});
371	yield* fileSystem.writeFile(absolutePath, bytes);
372	}),
373	{ concurrency: 1 },
374	);
375	});	314	});
376		315
377	const makeOrchestrationProjectionPipeline = Effect.gen(function* () {	316	const makeOrchestrationProjectionPipeline = Effect.gen(function* () {
...	@@ -589,16 +528,8 @@ const makeOrchestrationProjectionPipeline = Effect.gen(function* () {	...	@@ -589,16 +528,8 @@ const makeOrchestrationProjectionPipeline = Effect.gen(function* () {
589	const nextAttachments =	528	const nextAttachments =
590	event.payload.attachments !== undefined	529	event.payload.attachments !== undefined
591	? yield* materializeAttachmentsForProjection({	530	? yield* materializeAttachmentsForProjection({
592	threadId: event.payload.threadId,
593	messageId: event.payload.messageId,
594	attachments: event.payload.attachments,	531	attachments: event.payload.attachments,
595	stageFileWrite: (pendingWrite) => {	532	})
596	attachmentSideEffects.writes.push(pendingWrite);
597	},
598	}).pipe(
599	Effect.provideService(ServerConfig, serverConfig),
600	Effect.provideService(Path.Path, path),
601	)
602	: existingMessage?.attachments;	533	: existingMessage?.attachments;
603	yield* projectionThreadMessageRepository.upsert({	534	yield* projectionThreadMessageRepository.upsert({
604	messageId: event.payload.messageId,	535	messageId: event.payload.messageId,
...	@@ -1089,7 +1020,6 @@ const makeOrchestrationProjectionPipeline = Effect.gen(function* () {	...	@@ -1089,7 +1020,6 @@ const makeOrchestrationProjectionPipeline = Effect.gen(function* () {
1089	const runProjectorForEvent = (projector: ProjectorDefinition, event: OrchestrationEvent) =>	1020	const runProjectorForEvent = (projector: ProjectorDefinition, event: OrchestrationEvent) =>
1090	Effect.gen(function* () {	1021	Effect.gen(function* () {
1091	const attachmentSideEffects: AttachmentSideEffects = {	1022	const attachmentSideEffects: AttachmentSideEffects = {
1092	writes: [],
1093	deletedThreadIds: new Set<string>(),	1023	deletedThreadIds: new Set<string>(),
1094	prunedThreadRelativePaths: new Map<string, Set<string>>(),	1024	prunedThreadRelativePaths: new Map<string, Set<string>>(),
1095	};	1025	};

apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts+7-21

 @@ -258,10 +258,10 @@ describe("ProviderCommandReactor", () => {
           attachments: [
             {
               type: "image",
+              id: "thread-1-att-rename",
               name: "bug.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:image/png;base64,SGVsbG8=",
             },
           ],
         },
 @@ -280,15 +280,10 @@ describe("ProviderCommandReactor", () => {
       attachments: [
         {
           type: "image",
+          id: "thread-1-att-rename",
           name: "bug.png",
           mimeType: "image/png",
           sizeBytes: 5,
-          dataUrl: path.join(
-            harness.stateDir,
-            "attachments",
-            "thread-1",
-            "user-message-worktree-rename-0.png",
-          ),
         },
       ],
     });
 @@ -307,9 +302,8 @@ describe("ProviderCommandReactor", () => {
     });
   });
-  it("reuses persisted attachment files for branch generation and turn start", async () => {
+  it("passes persisted attachment references to branch generation and turn start", async () => {
-    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "t3code-reactor-attachments-"));
+    const harness = await createHarness();
-    const harness = await createHarness({ stateDir });
     const now = new Date().toISOString();
     await Effect.runPromise(
 @@ -334,10 +328,10 @@ describe("ProviderCommandReactor", () => {
           attachments: [
             {
               type: "image",
+              id: "thread-1-att-persisted",
               name: "bug.png",
               mimeType: "image/png",
               sizeBytes: 5,
-              dataUrl: "data:image/png;base64,SGVsbG8=",
             },
           ],
         },
 @@ -350,23 +344,16 @@ describe("ProviderCommandReactor", () => {
     await waitFor(() => harness.generateBranchName.mock.calls.length === 1);
     await waitFor(() => harness.sendTurn.mock.calls.length === 1);
-    const expectedAttachmentPath = path.join(
-      stateDir,
-      "attachments",
-      "thread-1",
-      "user-message-persisted-attachments-0.png",
-    );
     expect(harness.generateBranchName.mock.calls[0]?.[0]).toEqual({
       cwd: "/tmp/provider-project/.t3/worktrees/t3code-abcdef12",
       message: "Fix visual bug from screenshot",
       attachments: [
         {
           type: "image",
+          id: "thread-1-att-persisted",
           name: "bug.png",
           mimeType: "image/png",
           sizeBytes: 5,
-          dataUrl: expectedAttachmentPath,
         },
       ],
     });
 @@ -374,14 +361,13 @@ describe("ProviderCommandReactor", () => {
       attachments: [
         {
           type: "image",
+          id: "thread-1-att-persisted",
           name: "bug.png",
           mimeType: "image/png",
           sizeBytes: 5,
-          dataUrl: "data:image/png;base64,SGVsbG8=",
         },
       ],
     });
-    expect(fs.existsSync(expectedAttachmentPath)).toBe(true);
   });
   it("skips worktree branch generation after the first user turn", async () => {

apps/server/src/orchestration/Layers/ProviderCommandReactor.ts+2-71

...	@@ -12,17 +12,11 @@ import {	...	@@ -12,17 +12,11 @@ import {
12	type ProviderThreadId,	12	type ProviderThreadId,
13	type TurnId,	13	type TurnId,
14	} from "@t3tools/contracts";	14	} from "@t3tools/contracts";
15	import { Cache, Cause, Duration, Effect, FileSystem, Layer, Option, Queue, Stream } from "effect";	15	import { Cache, Cause, Duration, Effect, Layer, Option, Queue, Stream } from "effect";
16		16
17	import { resolveThreadWorkspaceCwd } from "../../checkpointing/Utils.ts";	17	import { resolveThreadWorkspaceCwd } from "../../checkpointing/Utils.ts";
18	import {
19	resolveAttachmentRelativePath,
20	resolveAttachmentRoutePath,
21	} from "../../attachmentPaths.ts";
22	import { ServerConfig } from "../../config.ts";
23	import { GitCore } from "../../git/Services/GitCore.ts";	18	import { GitCore } from "../../git/Services/GitCore.ts";
24	import { TextGeneration } from "../../git/Services/TextGeneration.ts";	19	import { TextGeneration } from "../../git/Services/TextGeneration.ts";
25	import { inferImageExtension, parseBase64DataUrl } from "../../imageMime.ts";
26	import { ProviderService } from "../../provider/Services/ProviderService.ts";	20	import { ProviderService } from "../../provider/Services/ProviderService.ts";
27	import { OrchestrationEngineService } from "../Services/OrchestrationEngine.ts";	21	import { OrchestrationEngineService } from "../Services/OrchestrationEngine.ts";
28	import {	22	import {
...	@@ -109,8 +103,6 @@ const make = Effect.gen(function* () {	...	@@ -109,8 +103,6 @@ const make = Effect.gen(function* () {
109	const providerService = yield* ProviderService;	103	const providerService = yield* ProviderService;
110	const git = yield* GitCore;	104	const git = yield* GitCore;
111	const textGeneration = yield* TextGeneration;	105	const textGeneration = yield* TextGeneration;
112	const fileSystem = yield* FileSystem.FileSystem;
113	const serverConfig = yield* Effect.service(ServerConfig);
114	const handledTurnStartKeys = yield* Cache.make<string, true>({	106	const handledTurnStartKeys = yield* Cache.make<string, true>({
115	capacity: HANDLED_TURN_START_KEY_MAX,	107	capacity: HANDLED_TURN_START_KEY_MAX,
116	timeToLive: HANDLED_TURN_START_KEY_TTL,	108	timeToLive: HANDLED_TURN_START_KEY_TTL,
...	@@ -291,61 +283,6 @@ const make = Effect.gen(function* () {	...	@@ -291,61 +283,6 @@ const make = Effect.gen(function* () {
291	});	283	});
292	});	284	});
293		285
294	const resolvePersistedAttachments = Effect.fnUntraced(function* (input: {
295	readonly threadId: ThreadId;
296	readonly messageId: string;
297	readonly attachments: ReadonlyArray<ChatAttachment> \| undefined;
298	}) {
299	if (!input.attachments \|\| input.attachments.length === 0) {
300	return input.attachments ?? [];
301	}
302
303	const threadSegment = encodeURIComponent(input.threadId);
304	const messageSegment = encodeURIComponent(input.messageId);
305
306	return yield* Effect.forEach(Array.from(input.attachments.entries()), ([index, attachment]) =>
307	Effect.gen(function* () {
308	if (attachment.type !== "image") return attachment;
309
310	const resolvedRoutePath = resolveAttachmentRoutePath({
311	stateDir: serverConfig.stateDir,
312	dataUrl: attachment.dataUrl,
313	});
314	const resolvedMaterializedPath =
315	resolvedRoutePath ??
316	(() => {
317	const parsed = parseBase64DataUrl(attachment.dataUrl);
318	if (!parsed \|\| !parsed.mimeType.startsWith("image/")) {
319	return null;
320	}
321	const extension = inferImageExtension({
322	mimeType: parsed.mimeType,
323	fileName: attachment.name,
324	});
325	return resolveAttachmentRelativePath({
326	stateDir: serverConfig.stateDir,
327	relativePath: `${threadSegment}/${messageSegment}-${index}${extension}`,
328	});
329	})();
330
331	if (!resolvedMaterializedPath) {
332	return attachment;
333	}
334
335	const fileInfo = yield* fileSystem
336	.stat(resolvedMaterializedPath)
337	.pipe(Effect.catch(() => Effect.succeed(null)));
338	if (!fileInfo \|\| fileInfo.type !== "File") {
339	return attachment;
340	}
341	return {
342	...attachment,
343	dataUrl: resolvedMaterializedPath,
344	} satisfies ChatAttachment;
345	}),
346	);
347	});
348
349	const maybeGenerateAndRenameWorktreeBranchForFirstTurn = Effect.fnUntraced(function* (input: {	286	const maybeGenerateAndRenameWorktreeBranchForFirstTurn = Effect.fnUntraced(function* (input: {
350	readonly threadId: ThreadId;	287	readonly threadId: ThreadId;
351	readonly branch: string \| null;	288	readonly branch: string \| null;
...	@@ -440,19 +377,13 @@ const make = Effect.gen(function* () {	...	@@ -440,19 +377,13 @@ const make = Effect.gen(function* () {
440	return;	377	return;
441	}	378	}
442		379
443	const branchGenerationAttachments = yield* resolvePersistedAttachments({
444	threadId: event.payload.threadId,
445	messageId: message.id,
446	attachments: message.attachments,
447	});
448
449	yield* maybeGenerateAndRenameWorktreeBranchForFirstTurn({	380	yield* maybeGenerateAndRenameWorktreeBranchForFirstTurn({
450	threadId: event.payload.threadId,	381	threadId: event.payload.threadId,
451	branch: thread.branch,	382	branch: thread.branch,
452	worktreePath: thread.worktreePath,	383	worktreePath: thread.worktreePath,
453	messageId: message.id,	384	messageId: message.id,
454	messageText: message.text,	385	messageText: message.text,
455	...(message.attachments !== undefined ? { attachments: branchGenerationAttachments } : {}),	386	...(message.attachments !== undefined ? { attachments: message.attachments } : {}),
456	}).pipe(Effect.forkScoped);	387	}).pipe(Effect.forkScoped);
457		388
458	yield* sendTurnForThread({	389	yield* sendTurnForThread({

apps/server/src/persistence/Layers/ProjectionThreadMessages.test.ts+2-2

 @@ -21,10 +21,10 @@ layer("ProjectionThreadMessageRepository", (it) => {
       const persistedAttachments = [
         {
           type: "image" as const,
+          id: "thread-preserve-attachments-att-1",
           name: "example.png",
           mimeType: "image/png",
           sizeBytes: 5,
-          dataUrl: "/attachments/thread-preserve-attachments/message-preserve-attachments/0.png",
         },
       ];
 @@ -74,10 +74,10 @@ layer("ProjectionThreadMessageRepository", (it) => {
         attachments: [
           {
             type: "image",
+            id: "thread-clear-attachments-att-1",
             name: "example.png",
             mimeType: "image/png",
             sizeBytes: 5,
-            dataUrl: "/attachments/thread-clear-attachments/message-clear-attachments/0.png",
           },
         ],
         isStreaming: false,

apps/server/src/provider/Layers/CodexAdapter.test.ts+27-8

 @@ -4,7 +4,6 @@ import {
   ProviderItemId,
   type ProviderApprovalDecision,
   type ProviderEvent,
-  type ProviderSendTurnInput,
   ProviderSessionId,
   type ProviderSession,
   type ProviderSessionStartInput,
 @@ -12,12 +11,17 @@ import {
   ProviderTurnId,
   type ProviderTurnStartResult,
 } from "@t3tools/contracts";
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import { afterAll, assert, it, vi } from "@effect/vitest";
 import { assertFailure } from "@effect/vitest/utils";
-import { Effect, Fiber, Stream } from "effect";
+import { Effect, Fiber, Layer, Stream } from "effect";
-import { CodexAppServerManager } from "../../codexAppServerManager.ts";
+import {
+  CodexAppServerManager,
+  type CodexAppServerSendTurnInput,
+} from "../../codexAppServerManager.ts";
+import { ServerConfig } from "../../config.ts";
 import { ProviderAdapterValidationError } from "../Errors.ts";
 import { CodexAdapter } from "../Services/CodexAdapter.ts";
 import { makeCodexAdapterLive } from "./CodexAdapter.ts";
 @@ -44,7 +48,7 @@ class FakeCodexManager extends CodexAppServerManager {
   );
   public sendTurnImpl = vi.fn(
-    async (_input: ProviderSendTurnInput): Promise<ProviderTurnStartResult> => ({
+    async (_input: CodexAppServerSendTurnInput): Promise<ProviderTurnStartResult> => ({
       threadId: ProviderThreadId.makeUnsafe("thread-1"),
       turnId: asTurnId("turn-1"),
     }),
 @@ -78,7 +82,7 @@ class FakeCodexManager extends CodexAppServerManager {
     return this.startSessionImpl(input);
   }
-  override sendTurn(input: ProviderSendTurnInput): Promise<ProviderTurnStartResult> {
+  override sendTurn(input: CodexAppServerSendTurnInput): Promise<ProviderTurnStartResult> {
     return this.sendTurnImpl(input);
   }
 @@ -118,7 +122,12 @@ class FakeCodexManager extends CodexAppServerManager {
 }
 const validationManager = new FakeCodexManager();
-const validationLayer = it.layer(makeCodexAdapterLive({ manager: validationManager }));
+const validationLayer = it.layer(
+  makeCodexAdapterLive({ manager: validationManager }).pipe(
+    Layer.provideMerge(ServerConfig.layerTest(process.cwd(), process.cwd())),
+    Layer.provideMerge(NodeServices.layer),
+  ),
+);
 validationLayer("CodexAdapterLive validation", (it) => {
   it.effect("returns validation error for non-codex provider on startSession", () =>
 @@ -147,7 +156,12 @@ const sessionErrorManager = new FakeCodexManager();
 sessionErrorManager.sendTurnImpl.mockImplementation(async () => {
   throw new Error("Unknown session: sess-missing");
 });
-const sessionErrorLayer = it.layer(makeCodexAdapterLive({ manager: sessionErrorManager }));
+const sessionErrorLayer = it.layer(
+  makeCodexAdapterLive({ manager: sessionErrorManager }).pipe(
+    Layer.provideMerge(ServerConfig.layerTest(process.cwd(), process.cwd())),
+    Layer.provideMerge(NodeServices.layer),
+  ),
+);
 sessionErrorLayer("CodexAdapterLive session errors", (it) => {
   it.effect("maps unknown-session sendTurn errors to ProviderAdapterSessionNotFoundError", () =>
 @@ -178,7 +192,12 @@ sessionErrorLayer("CodexAdapterLive session errors", (it) => {
 });
 const lifecycleManager = new FakeCodexManager();
-const lifecycleLayer = it.layer(makeCodexAdapterLive({ manager: lifecycleManager }));
+const lifecycleLayer = it.layer(
+  makeCodexAdapterLive({ manager: lifecycleManager }).pipe(
+    Layer.provideMerge(ServerConfig.layerTest(process.cwd(), process.cwd())),
+    Layer.provideMerge(NodeServices.layer),
+  ),
+);
 lifecycleLayer("CodexAdapterLive lifecycle", (it) => {
   it.effect("maps completed agent message items to canonical message.completed events", () =>

apps/server/src/provider/Layers/CodexAdapter.ts+45-4

...	@@ -17,7 +17,7 @@ import {	...	@@ -17,7 +17,7 @@ import {
17	ProviderThreadId,	17	ProviderThreadId,
18	ProviderTurnId,	18	ProviderTurnId,
19	} from "@t3tools/contracts";	19	} from "@t3tools/contracts";
20	import { Effect, Layer, Queue, Schema, Stream } from "effect";	20	import { Effect, FileSystem, Layer, Queue, Schema, Stream } from "effect";
21		21
22	import {	22	import {
23	ProviderAdapterProcessError,	23	ProviderAdapterProcessError,
...	@@ -29,6 +29,8 @@ import {	...	@@ -29,6 +29,8 @@ import {
29	} from "../Errors.ts";	29	} from "../Errors.ts";
30	import { CodexAdapter, type CodexAdapterShape } from "../Services/CodexAdapter.ts";	30	import { CodexAdapter, type CodexAdapterShape } from "../Services/CodexAdapter.ts";
31	import { CodexAppServerManager } from "../../codexAppServerManager.ts";	31	import { CodexAppServerManager } from "../../codexAppServerManager.ts";
		32	import { resolveAttachmentPath } from "../../attachmentStore.ts";
		33	import { ServerConfig } from "../../config.ts";
32	import { makeEventNdjsonLogger } from "./EventNdjsonLogger.ts";	34	import { makeEventNdjsonLogger } from "./EventNdjsonLogger.ts";
33		35
34	const PROVIDER = "codex" as const;	36	const PROVIDER = "codex" as const;
...	@@ -426,6 +428,8 @@ function mapToRuntimeEvents(event: ProviderEvent): ReadonlyArray<ProviderRuntime	...	@@ -426,6 +428,8 @@ function mapToRuntimeEvents(event: ProviderEvent): ReadonlyArray<ProviderRuntime
426		428
427	const makeCodexAdapter = (options?: CodexAdapterLiveOptions) =>	429	const makeCodexAdapter = (options?: CodexAdapterLiveOptions) =>
428	Effect.gen(function* () {	430	Effect.gen(function* () {
		431	const fileSystem = yield* FileSystem.FileSystem;
		432	const serverConfig = yield* Effect.service(ServerConfig);
429	const nativeEventLogger =	433	const nativeEventLogger =
430	options?.nativeEventLogPath !== undefined	434	options?.nativeEventLogPath !== undefined
431	? makeEventNdjsonLogger(options.nativeEventLogPath)	435	? makeEventNdjsonLogger(options.nativeEventLogPath)
...	@@ -475,9 +479,46 @@ const makeCodexAdapter = (options?: CodexAdapterLiveOptions) =>	...	@@ -475,9 +479,46 @@ const makeCodexAdapter = (options?: CodexAdapterLiveOptions) =>
475	};	479	};
476		480
477	const sendTurn: CodexAdapterShape["sendTurn"] = (input) =>	481	const sendTurn: CodexAdapterShape["sendTurn"] = (input) =>
478	Effect.tryPromise({	482	Effect.gen(function* () {
479	try: () => manager.sendTurn(input),	483	const codexAttachments = yield* Effect.forEach(
480	catch: (cause) => toRequestError(input.sessionId, "turn/start", cause),	484	input.attachments ?? [],
		485	(attachment) =>
		486	Effect.gen(function* () {
		487	const attachmentPath = resolveAttachmentPath({
		488	stateDir: serverConfig.stateDir,
		489	attachment,
		490	});
		491	if (!attachmentPath) {
		492	return yield* toRequestError(
		493	input.sessionId,
		494	"turn/start",
		495	new Error(`Invalid attachment id '${attachment.id}'.`),
		496	);
		497	}
		498	const bytes = yield* fileSystem.readFile(attachmentPath).pipe(
		499	Effect.mapError((cause) => toRequestError(input.sessionId, "turn/start", cause)),
		500	);
		501	return {
		502	type: "image" as const,
		503	url: `data:${attachment.mimeType};base64,${Buffer.from(bytes).toString("base64")}`,
		504	};
		505	}),
		506	{ concurrency: 1 },
		507	);
		508
		509	return yield* Effect.tryPromise({
		510	try: () => {
		511	const managerInput = {
		512	sessionId: input.sessionId,
		513	...(input.input !== undefined ? { input: input.input } : {}),
		514	...(input.model !== undefined ? { model: input.model } : {}),
		515	...(input.effort !== undefined ? { effort: input.effort } : {}),
		516	...(codexAttachments.length > 0 ? { attachments: codexAttachments } : {}),
		517	};
		518	return manager.sendTurn(managerInput);
		519	},
		520	catch: (cause) => toRequestError(input.sessionId, "turn/start", cause),
		521	});
481	});	522	});
482		523
483	const interruptTurn: CodexAdapterShape["interruptTurn"] = (sessionId, turnId) =>	524	const interruptTurn: CodexAdapterShape["interruptTurn"] = (sessionId, turnId) =>

apps/server/src/serverLayers.ts+2-2

...	@@ -1,7 +1,7 @@	...	@@ -1,7 +1,7 @@
1	import path from "node:path";	1	import path from "node:path";
2		2
3	import * as NodeServices from "@effect/platform-node/NodeServices";	3	import * as NodeServices from "@effect/platform-node/NodeServices";
4	import { Effect, Layer } from "effect";	4	import { Effect, FileSystem, Layer } from "effect";
5	import * as SqlClient from "effect/unstable/sql/SqlClient";	5	import * as SqlClient from "effect/unstable/sql/SqlClient";
6		6
7	import { CheckpointDiffQueryLive } from "./checkpointing/Layers/CheckpointDiffQuery";	7	import { CheckpointDiffQueryLive } from "./checkpointing/Layers/CheckpointDiffQuery";
...	@@ -37,7 +37,7 @@ import { NodePtyAdapterLive } from "./terminal/Layers/NodePTY";	...	@@ -37,7 +37,7 @@ import { NodePtyAdapterLive } from "./terminal/Layers/NodePTY";
37	export function makeServerProviderLayer(): Layer.Layer<	37	export function makeServerProviderLayer(): Layer.Layer<
38	ProviderService,	38	ProviderService,
39	ProviderUnsupportedError,	39	ProviderUnsupportedError,
40	SqlClient.SqlClient \| ServerConfig	40	SqlClient.SqlClient \| ServerConfig \| FileSystem.FileSystem
41	> {	41	> {
42	return Effect.gen(function* () {	42	return Effect.gen(function* () {
43	const { stateDir } = yield* ServerConfig;	43	const { stateDir } = yield* ServerConfig;

apps/server/src/wsServer.test.ts+1

...	@@ -420,6 +420,7 @@ describe("WebSocket Server", () => {	...	@@ -420,6 +420,7 @@ describe("WebSocket Server", () => {
420	Layer.provideMerge(runtimeLayer),	420	Layer.provideMerge(runtimeLayer),
421	Layer.provideMerge(openLayer),	421	Layer.provideMerge(openLayer),
422	Layer.provideMerge(serverConfigLayer),	422	Layer.provideMerge(serverConfigLayer),
		423	Layer.provideMerge(NodeServices.layer),
423	);	424	);
424	const runtimeServices = await Effect.runPromise(	425	const runtimeServices = await Effect.runPromise(
425	Layer.build(dependenciesLayer).pipe(Scope.provide(scope)),	426	Layer.build(dependenciesLayer).pipe(Scope.provide(scope)),

apps/server/src/wsServer.ts+99-5

...	@@ -12,8 +12,11 @@ import type { Duplex } from "node:stream";	...	@@ -12,8 +12,11 @@ import type { Duplex } from "node:stream";
12	import Mime from "@effect/platform-node/Mime";	12	import Mime from "@effect/platform-node/Mime";
13	import {	13	import {
14	CommandId,	14	CommandId,
		15	type ClientOrchestrationCommand,
		16	type OrchestrationCommand,
15	ORCHESTRATION_WS_CHANNELS,	17	ORCHESTRATION_WS_CHANNELS,
16	ORCHESTRATION_WS_METHODS,	18	ORCHESTRATION_WS_METHODS,
		19	PROVIDER_SEND_TURN_MAX_IMAGE_BYTES,
17	ProjectId,	20	ProjectId,
18	ThreadId,	21	ThreadId,
19	TerminalEvent,	22	TerminalEvent,
...	@@ -60,6 +63,8 @@ import {	...	@@ -60,6 +63,8 @@ import {
60	normalizeAttachmentRelativePath,	63	normalizeAttachmentRelativePath,
61	resolveAttachmentRelativePath,	64	resolveAttachmentRelativePath,
62	} from "./attachmentPaths";	65	} from "./attachmentPaths";
		66	import { createAttachmentId, resolveAttachmentPath, resolveAttachmentPathById } from "./attachmentStore.ts";
		67	import { parseBase64DataUrl } from "./imageMime.ts";
63		68
64	/**	69	/**
65	* ServerShape - Service API for server lifecycle control.	70	* ServerShape - Service API for server lifecycle control.
...	@@ -235,6 +240,88 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<	...	@@ -235,6 +240,88 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<
235	});	240	});
236	});	241	});
237		242
		243	const normalizeDispatchCommand = Effect.fnUntraced(function* (input: {
		244	readonly command: ClientOrchestrationCommand;
		245	}) {
		246	if (input.command.type !== "thread.turn.start") {
		247	return input.command as OrchestrationCommand;
		248	}
		249	const turnStartCommand = input.command;
		250
		251	const normalizedAttachments = yield* Effect.forEach(
		252	turnStartCommand.message.attachments,
		253	(attachment) =>
		254	Effect.gen(function* () {
		255	const parsed = parseBase64DataUrl(attachment.dataUrl);
		256	if (!parsed \|\| !parsed.mimeType.startsWith("image/")) {
		257	return yield* new RouteRequestError({
		258	message: `Invalid image attachment payload for '${attachment.name}'.`,
		259	});
		260	}
		261
		262	const bytes = Buffer.from(parsed.base64, "base64");
		263	if (bytes.byteLength === 0 \|\| bytes.byteLength > PROVIDER_SEND_TURN_MAX_IMAGE_BYTES) {
		264	return yield* new RouteRequestError({
		265	message: `Image attachment '${attachment.name}' is empty or too large.`,
		266	});
		267	}
		268
		269	const attachmentId = createAttachmentId(turnStartCommand.threadId);
		270	if (!attachmentId) {
		271	return yield* new RouteRequestError({
		272	message: "Failed to create a safe attachment id.",
		273	});
		274	}
		275
		276	const persistedAttachment = {
		277	type: "image" as const,
		278	id: attachmentId,
		279	name: attachment.name,
		280	mimeType: parsed.mimeType.toLowerCase(),
		281	sizeBytes: bytes.byteLength,
		282	};
		283
		284	const attachmentPath = resolveAttachmentPath({
		285	stateDir: serverConfig.stateDir,
		286	attachment: persistedAttachment,
		287	});
		288	if (!attachmentPath) {
		289	return yield* new RouteRequestError({
		290	message: `Failed to resolve persisted path for '${attachment.name}'.`,
		291	});
		292	}
		293
		294	yield* fileSystem.makeDirectory(path.dirname(attachmentPath), { recursive: true }).pipe(
		295	Effect.mapError(
		296	() =>
		297	new RouteRequestError({
		298	message: `Failed to create attachment directory for '${attachment.name}'.`,
		299	}),
		300	),
		301	);
		302	yield* fileSystem.writeFile(attachmentPath, bytes).pipe(
		303	Effect.mapError(
		304	() =>
		305	new RouteRequestError({
		306	message: `Failed to persist attachment '${attachment.name}'.`,
		307	}),
		308	),
		309	);
		310
		311	return persistedAttachment;
		312	}),
		313	{ concurrency: 1 },
		314	);
		315
		316	return {
		317	...turnStartCommand,
		318	message: {
		319	...turnStartCommand.message,
		320	attachments: normalizedAttachments,
		321	},
		322	} satisfies OrchestrationCommand;
		323	});
		324
238	// HTTP server — serves static files or redirects to Vite dev server	325	// HTTP server — serves static files or redirects to Vite dev server
239	const httpServer = http.createServer((req, res) => {	326	const httpServer = http.createServer((req, res) => {
240	const respond = (	327	const respond = (
...	@@ -261,10 +348,16 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<	...	@@ -261,10 +348,16 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<
261	return;	348	return;
262	}	349	}
263		350
264	const filePath = resolveAttachmentRelativePath({	351	const filePath =
265	stateDir: serverConfig.stateDir,	352	!normalizedRelativePath.includes("/") && !normalizedRelativePath.includes(".")
266	relativePath: normalizedRelativePath,	353	? resolveAttachmentPathById({
267	});	354	stateDir: serverConfig.stateDir,
		355	attachmentId: normalizedRelativePath,
		356	})
		357	: resolveAttachmentRelativePath({
		358	stateDir: serverConfig.stateDir,
		359	relativePath: normalizedRelativePath,
		360	});
268	if (!filePath) {	361	if (!filePath) {
269	respond(400, { "Content-Type": "text/plain" }, "Invalid attachment path");	362	respond(400, { "Content-Type": "text/plain" }, "Invalid attachment path");
270	return;	363	return;
...	@@ -508,7 +601,8 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<	...	@@ -508,7 +601,8 @@ export const createServer = Effect.fn(function* (): Effect.fn.Return<
508		601
509	case ORCHESTRATION_WS_METHODS.dispatchCommand: {	602	case ORCHESTRATION_WS_METHODS.dispatchCommand: {
510	const { command } = request.body;	603	const { command } = request.body;
511	return yield* orchestrationEngine.dispatch(command);	604	const normalizedCommand = yield* normalizeDispatchCommand({ command });
		605	return yield* orchestrationEngine.dispatch(normalizedCommand);
512	}	606	}
513		607
514	case ORCHESTRATION_WS_METHODS.getTurnDiff: {	608	case ORCHESTRATION_WS_METHODS.getTurnDiff: {

apps/web/src/store.ts+7-3

 @@ -229,6 +229,10 @@ function toAttachmentPreviewUrl(rawUrl: string): string {
   return rawUrl;
 }
+function attachmentPreviewRoutePath(attachmentId: string): string {
+  return `/attachments/${encodeURIComponent(attachmentId)}`;
+}
 function normalizeTerminalIds(terminalIds: string[]): string[] {
   const ids = terminalIds.map((id) => id.trim()).filter((id) => id.length > 0);
   const unique = [...new Set(ids)].slice(0, MAX_THREAD_TERMINAL_COUNT);
 @@ -487,13 +491,13 @@ export function reducer(state: AppState, action: Action): AppState {
                 }
               : null,
             messages: thread.messages.map((message) => {
-              const attachments = message.attachments?.map((attachment, index) => ({
+              const attachments = message.attachments?.map((attachment) => ({
                 type: "image" as const,
-                id: `${message.id}:${index}`,
+                id: attachment.id,
                 name: attachment.name,
                 mimeType: attachment.mimeType,
                 sizeBytes: attachment.sizeBytes,
-                previewUrl: toAttachmentPreviewUrl(attachment.dataUrl),
+                previewUrl: toAttachmentPreviewUrl(attachmentPreviewRoutePath(attachment.id)),
               }));
               const normalizedMessage: ChatMessage = {
                 id: message.id,

packages/contracts/src/orchestration.ts+55-3

...	@@ -60,12 +60,28 @@ export const PROVIDER_SEND_TURN_MAX_INPUT_CHARS = 120_000;	...	@@ -60,12 +60,28 @@ export const PROVIDER_SEND_TURN_MAX_INPUT_CHARS = 120_000;
60	export const PROVIDER_SEND_TURN_MAX_ATTACHMENTS = 8;	60	export const PROVIDER_SEND_TURN_MAX_ATTACHMENTS = 8;
61	export const PROVIDER_SEND_TURN_MAX_IMAGE_BYTES = 10 * 1024 * 1024;	61	export const PROVIDER_SEND_TURN_MAX_IMAGE_BYTES = 10 * 1024 * 1024;
62	export const PROVIDER_SEND_TURN_MAX_IMAGE_DATA_URL_CHARS = 14_000_000;	62	export const PROVIDER_SEND_TURN_MAX_IMAGE_DATA_URL_CHARS = 14_000_000;
		63	export const CHAT_ATTACHMENT_ID_MAX_CHARS = 128;
63		64
64	// Correlation id is command id by design in this model.	65	// Correlation id is command id by design in this model.
65	export const CorrelationId = CommandId;	66	export const CorrelationId = CommandId;
66	export type CorrelationId = typeof CorrelationId.Type;	67	export type CorrelationId = typeof CorrelationId.Type;
67		68
		69	export const ChatAttachmentId = TrimmedNonEmptyString.check(
		70	Schema.isMaxLength(CHAT_ATTACHMENT_ID_MAX_CHARS),
		71	Schema.isPattern(/^[a-z0-9_-]+$/i),
		72	);
		73	export type ChatAttachmentId = typeof ChatAttachmentId.Type;
		74
68	export const ChatImageAttachment = Schema.Struct({	75	export const ChatImageAttachment = Schema.Struct({
		76	type: Schema.Literal("image"),
		77	id: ChatAttachmentId,
		78	name: TrimmedNonEmptyString.check(Schema.isMaxLength(255)),
		79	mimeType: TrimmedNonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^image\//i)),
		80	sizeBytes: NonNegativeInt.check(Schema.isLessThanOrEqualTo(PROVIDER_SEND_TURN_MAX_IMAGE_BYTES)),
		81	});
		82	export type ChatImageAttachment = typeof ChatImageAttachment.Type;
		83
		84	export const UploadChatImageAttachment = Schema.Struct({
69	type: Schema.Literal("image"),	85	type: Schema.Literal("image"),
70	name: TrimmedNonEmptyString.check(Schema.isMaxLength(255)),	86	name: TrimmedNonEmptyString.check(Schema.isMaxLength(255)),
71	mimeType: TrimmedNonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^image\//i)),	87	mimeType: TrimmedNonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^image\//i)),
...	@@ -74,10 +90,12 @@ export const ChatImageAttachment = Schema.Struct({	...	@@ -74,10 +90,12 @@ export const ChatImageAttachment = Schema.Struct({
74	Schema.isMaxLength(PROVIDER_SEND_TURN_MAX_IMAGE_DATA_URL_CHARS),	90	Schema.isMaxLength(PROVIDER_SEND_TURN_MAX_IMAGE_DATA_URL_CHARS),
75	),	91	),
76	});	92	});
77	export type ChatImageAttachment = typeof ChatImageAttachment.Type;	93	export type UploadChatImageAttachment = typeof UploadChatImageAttachment.Type;
78		94
79	export const ChatAttachment = Schema.Union([ChatImageAttachment]);	95	export const ChatAttachment = Schema.Union([ChatImageAttachment]);
80	export type ChatAttachment = typeof ChatAttachment.Type;	96	export type ChatAttachment = typeof ChatAttachment.Type;
		97	export const UploadChatAttachment = Schema.Union([UploadChatImageAttachment]);
		98	export type UploadChatAttachment = typeof UploadChatAttachment.Type;
81		99
82	export const ProjectScriptIcon = Schema.Literals([	100	export const ProjectScriptIcon = Schema.Literals([
83	"play",	101	"play",
...	@@ -307,6 +325,24 @@ export const ThreadTurnStartCommand = Schema.Struct({	...	@@ -307,6 +325,24 @@ export const ThreadTurnStartCommand = Schema.Struct({
307	createdAt: IsoDateTime,	325	createdAt: IsoDateTime,
308	});	326	});
309		327
		328	export const ClientThreadTurnStartCommand = Schema.Struct({
		329	type: Schema.Literal("thread.turn.start"),
		330	commandId: CommandId,
		331	threadId: ThreadId,
		332	message: Schema.Struct({
		333	messageId: MessageId,
		334	role: Schema.Literal("user"),
		335	text: Schema.String,
		336	attachments: Schema.Array(UploadChatAttachment),
		337	}),
		338	model: Schema.optional(TrimmedNonEmptyString),
		339	effort: Schema.optional(TrimmedNonEmptyString),
		340	assistantDeliveryMode: Schema.optional(AssistantDeliveryMode),
		341	approvalPolicy: ProviderApprovalPolicy,
		342	sandboxMode: ProviderSandboxMode,
		343	createdAt: IsoDateTime,
		344	});
		345
310	export const ThreadTurnInterruptCommand = Schema.Struct({	346	export const ThreadTurnInterruptCommand = Schema.Struct({
311	type: Schema.Literal("thread.turn.interrupt"),	347	type: Schema.Literal("thread.turn.interrupt"),
312	commandId: CommandId,	348	commandId: CommandId,
...	@@ -339,7 +375,7 @@ export const ThreadSessionStopCommand = Schema.Struct({	...	@@ -339,7 +375,7 @@ export const ThreadSessionStopCommand = Schema.Struct({
339	createdAt: IsoDateTime,	375	createdAt: IsoDateTime,
340	});	376	});
341		377
342	export const ClientOrchestrationCommand = Schema.Union([	378	export const DispatchableClientOrchestrationCommand = Schema.Union([
343	ProjectCreateCommand,	379	ProjectCreateCommand,
344	ProjectMetaUpdateCommand,	380	ProjectMetaUpdateCommand,
345	ProjectDeleteCommand,	381	ProjectDeleteCommand,
...	@@ -352,6 +388,22 @@ export const ClientOrchestrationCommand = Schema.Union([	...	@@ -352,6 +388,22 @@ export const ClientOrchestrationCommand = Schema.Union([
352	ThreadCheckpointRevertCommand,	388	ThreadCheckpointRevertCommand,
353	ThreadSessionStopCommand,	389	ThreadSessionStopCommand,
354	]);	390	]);
		391	export type DispatchableClientOrchestrationCommand =
		392	typeof DispatchableClientOrchestrationCommand.Type;
		393
		394	export const ClientOrchestrationCommand = Schema.Union([
		395	ProjectCreateCommand,
		396	ProjectMetaUpdateCommand,
		397	ProjectDeleteCommand,
		398	ThreadCreateCommand,
		399	ThreadDeleteCommand,
		400	ThreadMetaUpdateCommand,
		401	ClientThreadTurnStartCommand,
		402	ThreadTurnInterruptCommand,
		403	ThreadApprovalRespondCommand,
		404	ThreadCheckpointRevertCommand,
		405	ThreadSessionStopCommand,
		406	]);
355	export type ClientOrchestrationCommand = typeof ClientOrchestrationCommand.Type;	407	export type ClientOrchestrationCommand = typeof ClientOrchestrationCommand.Type;
356		408
357	export const ThreadSessionSetCommand = Schema.Struct({	409	export const ThreadSessionSetCommand = Schema.Struct({
...	@@ -422,7 +474,7 @@ export const InternalOrchestrationCommand = Schema.Union([	...	@@ -422,7 +474,7 @@ export const InternalOrchestrationCommand = Schema.Union([
422	export type InternalOrchestrationCommand = typeof InternalOrchestrationCommand.Type;	474	export type InternalOrchestrationCommand = typeof InternalOrchestrationCommand.Type;
423		475
424	export const OrchestrationCommand = Schema.Union([	476	export const OrchestrationCommand = Schema.Union([
425	ClientOrchestrationCommand,	477	DispatchableClientOrchestrationCommand,
426	InternalOrchestrationCommand,	478	InternalOrchestrationCommand,
427	]);	479	]);
428	export type OrchestrationCommand = typeof OrchestrationCommand.Type;	480	export type OrchestrationCommand = typeof OrchestrationCommand.Type;

author	Julius Marminge <julius0216@outlook.com> 2026-03-01 01:42:02-08:00
committer	Julius Marminge <jmarminge@gmail.com> 2026-03-01 20:06:21-08:00
log	c0054cb56f1439c7bfda7771f919bdb7f948bab7
tree	8148227ca4aa09e7121c259e5564650c926a9b80
parent	41734dfbbfd47d2d9639dfbdd0912bb623e51403

Switch image attachments to persisted ID-based paths